djpbessems/lucidAuth
1
0
Fork 0
Code Issues Pull Requests Releases 2 Wiki Activity

Compare commits

base: djpbessems:ee35696cd42bb3b4a4515611b8a497fd2c6866da
Branches Tags
djpbessems:master djpbessems:development
djpbessems:0.6 djpbessems:0.5
..
compare: djpbessems:0.5
Branches Tags
djpbessems:development djpbessems:master
djpbessems:0.6 djpbessems:0.5

6 Commits
ee35696cd4 ... 0.5

Author SHA1 Message Date
Danny Bessems
75e8640439 Merge branch 'development' of djpbessems/lucidAuth into master 2019-06-19 10:57:55 +00:00
Danny Bessems
dca8f74f25 Minor edits (housekeeping) 2019-06-19 10:55:01 +00:00
Danny Bessems
21f272e9f0 Renamed file to reflect actual purpose 2019-06-19 10:37:20 +00:00
Danny Bessems
5a2d3313e7 Added missing CORS headers and xhrFields 2019-06-19 10:34:31 +00:00
Danny Bessems
6081e42d14 Resolved merge conflicts 2019-06-19 10:14:04 +00:00
Danny Bessems
0675ad8512 Controller for cross-domain iframes added 2019-06-19 10:09:46 +00:00
4 changed files with 40 additions and 43 deletions
Expand all files Collapse all files

17
include/lucidAuth.template.php
View File

@ -72,23 +72,6 @@ $pageLayout['full_alt'] = <<<'FULL_ALT'
</html> </html>
FULL_ALT; FULL_ALT;
$pageLayout['frames'] = <<<'FRAMES'
<!DOCTYPE html>
<html lang="nl">
<head>
<meta charset="utf-8" />
<title>lucidAuth</title>
<meta name="application-name" content="lucidAuth" />
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.js"></script>
<script src="misc/script.iframe.js"></script>
<script>%1$s</script>
</head>
<body>
%2$s
</body>
</html>
FRAMES;
$contentLayout['login'] = <<<'LOGIN' $contentLayout['login'] = <<<'LOGIN'
<script src="misc/script.index.js"></script> <script src="misc/script.index.js"></script>
<section> <section>

3
public/lucidAuth.login.php
View File

@ -39,7 +39,8 @@
"Result" => "Success", "Result" => "Success",
"Location" => $originalUri, "Location" => $originalUri,
"CrossDomainLogin" => $settings->Session['CrossDomainLogin'], "CrossDomainLogin" => $settings->Session['CrossDomainLogin'],
"CookieDomains" => json_encode(array_diff($settings->Session['CookieDomains'], $_SERVER['HTTP_HOST'])) "CookieDomains" => json_encode(array_diff($settings->Session['CookieDomains'], [$_SERVER['HTTP_HOST']])),
"SecureToken" => $result['token']
]); ]);
} else { } else {
switch ($result['reason']) { switch ($result['reason']) {

17
public/lucidAuth.setXDomainCookie.php → public/lucidAuth.requestCookie.php
View File

@ -18,14 +18,21 @@
switch ($queryString['action']) { switch ($queryString['action']) {
case 'login': case 'login':
if (validateToken($queryString['token'])['status'] === "Success") { if (validateToken($queryString['token'])['status'] === "Success") {
// This request appears valid; store a cookie // This request appears valid; try storing a cookie
$httpHost = $_SERVER['HTTP_HOST']; $httpHost = $_SERVER['HTTP_HOST'];
$httpOrigin = $_SERVER['HTTP_ORIGIN'];
// Check if $_SERVER['HTTP_HOST'] and $_SERVER['HTTP_ORIGIN'] match any of the configured domains (either explicitly or as a subdomain)
// This might seem backwards, but relying on $_SERVER directly allows spoofed values with potential security risks
$cookieDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpHost) { $cookieDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpHost) {
// Check if $_SERVER['HTTP_HOST'] matches any of the configured domains (either explicitly or as a subdomain) return (strlen($value) > strlen($httpHost)) ? false : (0 === substr_compare($httpHost, $value, -strlen($value)));
// This might seem backwards, but relying on $_SERVER directly allows spoofed values with potential security risks
return (strlen($value) > strlen($httpHost)) ? false : (0 === substr_compare($httpHost, $value, -strlen($value)));
}))[0]; }))[0];
if ($cookieDomain && setcookie('JWT', $queryString['token'], (time() + $settings->Session['Duration']), '/', '.' . $cookieDomain)) { $originDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpOrigin) {
return (strlen($value) > strlen($httpOrigin)) ? false : (0 === substr_compare($httpOrigin, $value, -strlen($value)));
}))[0];
if (($cookieDomain && (is_null($httpOrigin) || $originDomain)) && setcookie('JWT', $queryString['token'], (time() + $settings->Session['Duration']), '/', '.' . $cookieDomain)) {
header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
header('Access-Control-Allow-Credentials: true');
header('Access-Control-Max-Age: 86400');
header("HTTP/1.1 202 Accepted"); header("HTTP/1.1 202 Accepted");
exit; exit;
} }

46
public/misc/script.index.js
View File

@ -31,28 +31,34 @@ $(document).ready(function(){
'color': '#FFF' 'color': '#FFF'
}); });
if (data.CrossDomainLogin) { if (data.CrossDomainLogin) {
console.log('CrossDomainLogin initiated'); var cookieDomains = JSON.parse(data.CookieDomains);
// For reference: var XHR = [];
// [ cookieDomains.forEach(function(domain) {
// "Result" => "Success", XHR.push($.get({
// "Location" => $originalUri, url: "https://auth." + domain + "/lucidAuth.requestCookie.php",
// "CrossDomainLogin" => $settings->Session['CrossDomainLogin'], crossDomain: true,
// "CookieDomains" => json_encode(array_diff($settings->Session['CookieDomains'], $_SERVER['HTTP_HOST'])) xhrFields: {
// ]); withCredentials: true,
},
var cookieDomains = json_decode(data.CookieDomains); data: {
console.log(data.CookieDomains); ref: btoa(JSON.stringify({
// let the client setup multiple iframes for all domains action: 'login',
// psuedo-code: foreach (cookieDomains as domain) { $.get(domain, ref=[action,token])} token: data.SecureToken
}))
// validate each request against JWT-tokens in database }
// load all iframes parallel, show user progress and redirect once all iframes have finished loading; or after treshold of X ms has been reached }));
// origin domain should be exempted from the treshold (because origin domain can be different from current domain -due to traefik design). });
$.when.apply($, XHR).then(function(){
$.each(arguments, function(_index, _arg) {
// Show progress somehow (maybe something like https://minicss.org/v2/progress)
});
});
} }
// Finished (either succesfully or through timeout) cross-domain logins // Finished (either succesfully or through timeout) cross-domain logins
window.location.replace(data.Location); // redirect once all finished loading or timeout after $X ms
// origin domain should be exempted from timeout
// (because origin domain can/will be different from current domain --due to traefik design).
//window.location.replace(data.Location);
}, 2250); }, 2250);
} else { } else {
$('#btnlogin').css({ $('#btnlogin').css({